Question 1

What is CVE-2026-14537 — CVE-2026-14537?

Accepted Answer

Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to invoke tools protected by the scopeRequired feature via sending tool invocation requests through legacy HTTP endpoints when the --enable-api…

Question 2

What is the authoritative source for CVE-2026-14537?

Accepted Answer

CVE-2026-14537 (CVE-2026-14537) is catalogued in NVD + CISA KEV + FIRST EPSS and curated for EU compliance use cases by SQUR.

CVE-2026-14537CVE-2026-14537

Description

Scoring